diff --git a/hack/lib/init.sh b/hack/lib/init.sh
index 7f5f4f0e108..fd1d6868ca0 100755
--- a/hack/lib/init.sh
+++ b/hack/lib/init.sh
@@ -41,9 +41,21 @@ fi
 # The root of the build/dist directory
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 
-KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
-KUBE_OUTPUT="${KUBE_ROOT}/${KUBE_OUTPUT_SUBPATH}"
-KUBE_OUTPUT_BIN="${KUBE_OUTPUT}/bin"
+# Where output goes.  We should avoid redefining these anywhere else.
+#
+# KUBE_OUTPUT: the root directory (absolute) where this build should drop any
+#     files (subdirs are encouraged).
+# KUBE_OUTPUT_BIN: the directory in which compiled binaries will be placed,
+#     under OS/ARCH specific subdirs
+# THIS_PLATFORM_BIN: a symlink to the output directory for binaries built for
+#     the current host platform (e.g. build/test tools).
+#
+# Compat: The KUBE_OUTPUT_SUBPATH variable is sometimes passed in by callers.
+# If it is specified, we'll use it in KUBE_OUTPUT.
+_KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
+export KUBE_OUTPUT="${KUBE_ROOT}/${_KUBE_OUTPUT_SUBPATH}"
+export KUBE_OUTPUT_BIN="${KUBE_OUTPUT}/bin"
+export THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
 
 # This controls rsync compression. Set to a value > 0 to enable rsync
 # compression for build container
@@ -53,9 +65,6 @@ KUBE_RSYNC_COMPRESS="${KUBE_RSYNC_COMPRESS:-0}"
 # the connections to localhost in scripts will time out
 export no_proxy="127.0.0.1,localhost${no_proxy:+,${no_proxy}}"
 
-# This is a symlink to binaries for "this platform", e.g. build tools.
-export THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
-
 source "${KUBE_ROOT}/hack/lib/util.sh"
 source "${KUBE_ROOT}/hack/lib/logging.sh"
 
@@ -66,9 +75,6 @@ source "${KUBE_ROOT}/hack/lib/version.sh"
 source "${KUBE_ROOT}/hack/lib/golang.sh"
 source "${KUBE_ROOT}/hack/lib/etcd.sh"
 
-KUBE_OUTPUT_HOSTBIN="${KUBE_OUTPUT_BIN}/$(kube::util::host_platform)"
-export KUBE_OUTPUT_HOSTBIN
-
 # list of all available group versions.  This should be used when generated code
 # or when starting an API server that you want to have everything.
 # most preferred version for a group should appear first
diff --git a/hack/make-rules/test-cmd.sh b/hack/make-rules/test-cmd.sh
index c07d4682703..d9bf2bd2385 100755
--- a/hack/make-rules/test-cmd.sh
+++ b/hack/make-rules/test-cmd.sh
@@ -64,7 +64,7 @@ function run_kube_apiserver() {
   # Enable features
   ENABLE_FEATURE_GATES=""
 
-  "${KUBE_OUTPUT_HOSTBIN}/kube-apiserver" \
+  "${THIS_PLATFORM_BIN}/kube-apiserver" \
     --bind-address="127.0.0.1" \
     --authorization-mode="${AUTHORIZATION_MODE}" \
     --secure-port="${SECURE_API_PORT}" \
@@ -119,7 +119,7 @@ current-context: local-context
 EOF
 
   kube::log::status "Starting controller-manager"
-  "${KUBE_OUTPUT_HOSTBIN}/kube-controller-manager" \
+  "${THIS_PLATFORM_BIN}/kube-controller-manager" \
     --kube-api-content-type="${KUBE_TEST_API_TYPE-}" \
     --cluster-signing-cert-file=hack/testdata/ca/ca.crt \
     --cluster-signing-key-file=hack/testdata/ca/ca.key \
diff --git a/hack/update-openapi-spec.sh b/hack/update-openapi-spec.sh
index 389f1f9d81c..57152fc9689 100755
--- a/hack/update-openapi-spec.sh
+++ b/hack/update-openapi-spec.sh
@@ -70,7 +70,7 @@ fi
 # Start kube-apiserver
 # omit enums from static openapi snapshots used to generate clients until #109177 is resolved
 kube::log::status "Starting kube-apiserver"
-"${KUBE_OUTPUT_HOSTBIN}/kube-apiserver" \
+"${THIS_PLATFORM_BIN}/kube-apiserver" \
   --bind-address="${API_HOST}" \
   --secure-port="${API_PORT}" \
   --etcd-servers="http://${ETCD_HOST}:${ETCD_PORT}" \
diff --git a/test/cmd/kubeconfig.sh b/test/cmd/kubeconfig.sh
index fd8533fbbf0..e6ff9a91c3b 100755
--- a/test/cmd/kubeconfig.sh
+++ b/test/cmd/kubeconfig.sh
@@ -243,7 +243,7 @@ run_client_config_tests() {
 
   # test invalid config
   kubectl config view | sed -E "s/apiVersion: .*/apiVersion: v-1/g" > "${TMPDIR:-/tmp}"/newconfig.yaml
-  output_message=$(! "${KUBE_OUTPUT_HOSTBIN}/kubectl" get pods --context="" --user="" --kubeconfig="${TMPDIR:-/tmp}"/newconfig.yaml 2>&1)
+  output_message=$(! "${THIS_PLATFORM_BIN}/kubectl" get pods --context="" --user="" --kubeconfig="${TMPDIR:-/tmp}"/newconfig.yaml 2>&1)
   kube::test::if_has_string "${output_message}" "error loading config file"
 
   output_message=$(! kubectl get pod --kubeconfig=missing-config 2>&1)
@@ -298,4 +298,4 @@ EOF
 
   set +o nounset
   set +o errexit
-}
\ No newline at end of file
+}
diff --git a/test/cmd/legacy-script.sh b/test/cmd/legacy-script.sh
index eb4f457dcb0..11d685b2808 100755
--- a/test/cmd/legacy-script.sh
+++ b/test/cmd/legacy-script.sh
@@ -81,7 +81,7 @@ export IMAGE_STATEFULSET_R1="registry.k8s.io/nginx-slim:0.7"
 export IMAGE_STATEFULSET_R2="registry.k8s.io/nginx-slim:0.8"
 
 # Expose kubectl directly for readability
-PATH="${KUBE_OUTPUT_HOSTBIN}":$PATH
+PATH="${THIS_PLATFORM_BIN}":$PATH
 
 # Define variables for resource types to prevent typos.
 clusterroles="clusterroles"
@@ -314,7 +314,7 @@ setup() {
 
   # Check kubectl
   kube::log::status "Running kubectl with no options"
-  "${KUBE_OUTPUT_HOSTBIN}/kubectl"
+  "${THIS_PLATFORM_BIN}/kubectl"
 
   # TODO: we need to note down the current default namespace and set back to this
   # namespace after the tests are done.